pgsql: Fix misparsing of empty value in conninfo_uri_parse_params().

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Fix misparsing of empty value in conninfo_uri_parse_params().
Date: 2015-02-21 18:00:07
Message-ID: E1YPELX-0004ue-6y@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix misparsing of empty value in conninfo_uri_parse_params().

After finding an "=" character, the pointer was advanced twice when it
should only advance once. This is harmless as long as the value after "="
has at least one character; but if it doesn't, we'd miss the terminator
character and include too much in the value.

In principle this could lead to reading off the end of memory. It does not
seem worth treating as a security issue though, because it would happen on
client side, and besides client logic that's taking conninfo strings from
untrusted sources has much worse security problems than this.

Report and patch received off-list from Thomas Fanghaenel.
Back-patch to 9.2 where the faulty code was introduced.

Branch
------
REL9_3_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/f389b6e0a7637de014e5ea1adbcfa50108bb4e58

Modified Files
--------------
src/interfaces/libpq/fe-connect.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Tom Lane 2015-02-21 18:27:17 pgsql: Minor code beautification in conninfo_uri_parse_params().
Previous Message Robert Haas 2015-02-21 17:20:25 pgsql: Don't require users of src/port/gettimeofday.c to initialize it.